MikroTik

kosztyua

@tslytsly
I was pinging from the router itself to 8.8.8.8, and the delay was same way measurable on WAN port. Upstream then? My ISP? What I could try is to connect out on VPN and see if the issue persists over that.

@savage
Flow control is set to off on all interfaces.

kosztyua

OK I've checked it, packet sniffer to wireshark, and seemingly there is nothing out of order. I can see the call being established, SRTP packets with sequence rising both ways throughout the call, even when the ping to external server is already times out. Only thing around the time when the lag beg...

kosztyua

Hi, Really need a capture of your WAN interface to diagnose this. For instance, it could be that not all the SIP traffic is successfully traversing the firewall, causing many re-transmissions which are hitting the firewall. This is unlikely, but possible depending on your SIP server setup. Are you ...

kosztyua

kosztyua

Do you have a packet capture? I dont have packet capture - what should I log? Post firewall on HEX, and if you have any queues - post them too. I don't have any queues, and as for firewall it worked fine for the past many months - only the SIP caused this issue, and only externally when NATing, as ...

kosztyua

Hi, I have encountered an extreme situation while configuring a new voip server. The voip server is now moved from local hosting to cloud, as such all phones internally go through boundary and NAT. Using two test phones, plugged in locally and connected to the remote server, when I call one from the...

kosztyua

Hi, I have tried to tackle the L2TP setup for a while but still no luck. Tried multiple configs, including that in this post. Each time I try to connect with IOS10, the log shows "tunnel xx received bad auth, response, stopping". The same config works with Android and Windows. Current setu...

kosztyua

So I guess the issue is solved. Reading tons of forum posts it seems the CRS lacks horsepower to do NAT. When I pumped up the CPU from the default 600mhz to 750mhz, the speedtest result went up from 80 to 90+ Mbit. So I'll have to put the 750GL as WAN and use CRS only for switching.

/thread

kosztyua

Quick update:
After finding this forum post and applying the suggested fix the speed went up to 83/20
http://forum.mikrotik.com/viewtopic.php?t=85339

This speed is now in accord with a 100Mbit link, but not the expected 1Gb with 240Mbit download speed.

kosztyua

Hi, Im facing a weird issue here. The main router in the office is a CRS125-24G-1S-2HnD and after getting an upgrade from the ISP I realized it is doing very slow on WAN. The link should be 240Mbit/20Mbit and with speedtest I can achieve 35/20. So I tried it my good old 750GL and it works as expecte...

kosztyua

Thank you for the answer! Maybe I wasn't clear enough. I have the following rules on branch site: allow established forward allow related forward drop all forward And still, I can ping PCs behind this branch router from the main site. As if the new (that is not related or established) communication ...

kosztyua

Hi, I have a concern about the SSTP tunnel setup. I have two mikrotik router (750 and CCS) with current version (6.24) and an SSTP tunnel between them according to the wiki manual. It works perfectly, both side the whole subnet is available through the tunnel. My issue is how do I limit this tunnel ...

kosztyua

Nobody?:/

kosztyua

kosztyua

bump?

kosztyua

Hi, How is the hardware encryption on RoS server based VPNs? I am interested mainly in SSTP, PPTP and OVPN. Running a few x86 servers, each around 100 users, 500/500Mbit peak on the tunnels. Considered CCR when they were released but at that time only ipsec acceleration - how about now? Thanks, Andras

kosztyua

Confirmed that 6.8rc1 with config reset fixes the issue.

kosztyua

Confirmed that 6.8rc1 with config reset fixes the issue.

kosztyua

Thank you, that's really reassuring fix is on the way

kosztyua

Hi, I was experiencing seemingly random slowing on my network, where a new CRS125-24G-1S-2HnD with 6.7 is the core router. 100Mbit internet connection, but at some points I could use only 2-4Mbit, although there was almost no traffic on the router. ISP said not their fault. Tonight I have found the ...

kosztyua

I left it to rest a day, then...
Well, currently at massive wtf. Only thing I did was upgrade firmware from 3.08 to 3.10 and all issues were fixed. IPSec tunnel is stable, no MSS issue, and can create IPSec from behind NAT.

/thread

kosztyua

Hi, I just bought a new CRS125-24G-1S-2HnD and upgraded to ros6.7 (after 6.5 failed in phase1 for no reason seemingly). It was going to exchange a Draytek 2920 which is failing due to lightning strike (only 1 wan and 1 lan works now). Now, the issue is ipsec, which works perfectly fine with draytek ...

kosztyua

Currently I am overly fed up with Mikrotik and RouterOS. We are providing a VPN service with PPTP, OVPN and SSTP, using x86 RouterOS. Yesterday I upgraded from 5.24 to enjoy the new features and kernel. I have waited long enough after 6.x coming to stable version. 6.4 failed me with freezes randomly...

kosztyua

Try pre-release rc12. A lot of fixes for ccr

not using CCR but x86 and prerelease doesnt have kvm or userman modules which I need

kosztyua

Sent to support with supout:

I have been running rc11 for about two weeks now and it was mostly fine for some time. In the past 4 days i get full freeze twice a day, requiring hard reset. Please help. On the next occasion I will need to downgrade ros ros5

Thanks,
Andras Kosztyu

kosztyua

Wow. Just wow. I dont think I would have ever thought of that. Thank you very much

kosztyua

Upgraded the affected router to ros 6rc9 earlier today, so far it is holding up, will keep testing. Thank you!

kosztyua

Hi, Here is my two test scripts: #test1 :global iface :foreach n in=[/interface find type=ovpn-in] do={ # :set iface [/interface get $n name] :log info $iface /system script run test2 } #test2 :global iface :log info $iface :delay 10 My question is, how do I make it run async, that is the first scri...

kosztyua

Thank you Simon, this looks great!

The problem is that I use dynamic interfaces for hundreds of VPN connections, but this is a great start. I should be able make a script that lists all the ovpn interfaces and foreach run this script on all.

Thanks,
Andras

kosztyua

Hi, Since I have started using Mikrotik there was a problem with OVPN, some of the users when disconnected suddenly (power outage, hibernation/sleep, else) are getting stuck on the mikrotik. That is, their interface is still there, their session is open on the radius. Tried with various timeout sett...

kosztyua

bump

Problem still not solved. Awaiting answer from support too, seems they went the wrong way as they asked me last time the radius version I use. The problem is not with radius, as OVPN continues working fine, only PPTP and SSTP stops working, the daemon itself on the 'tik.

kosztyua

Thank you for the reply! Yes ofc I set the source address for radius, I dont want cleartext passwords flying in the air :) And most of the time, also after restarting the pptp/sstp daemon, it is working fine. However, the later might be true anyway (radius server is now in cloud, maybe it slows down...

kosztyua

OK I have removed the new radius and added back the original one and for one hour it has been working fine. BUT WHY? I mean earlier when it stopped working, pptp went to error 807, it didnt even send radius requests, it refused earlier. Also, if this solves the problem, there is a new one: i really ...

kosztyua

PPTP is giving error 807. After restarting the daemon it works fine.

Also, as I actively monitor when it goes bad, it seems it cannot hold for more than a few minutes.

DESPERATELY NEED HELP, my customers are constantly nagging - rightfully.

kosztyua

Hi, Sent this to support, posting here too: I've been running ovpn, pptp and sstp servers for a while now, using 5.22 since it was released. Recently on one of the servers sstp stops working after a while: it does not accept new connections, but the ones made earlier work fine. I have to restart the...

kosztyua

Thanks for the update! I'm still waiting a bit to see mostly positive comments on the forum :) My main concern is still if the OVPN will work properly on CCR. I mean there will be no acceleration for OVPN even if using AES, and CCR has lower CPU clock, but many cores - how will ROS handle distributi...

kosztyua

Hi, Next bug report: In some cases (about 1-2 in every 1000) ovpn users get stuck in the router. The method of disconnect is not clear (regular, timeout, etc?), but the user still shows in the router and so the session is not cleared in the radius either. There is no data communication, interface sh...

kosztyua

I just spent 8 hours yesterday trying to install v6rc5 x86. I usually install routeros systems remotely, either through kvm or ipmi and so far I had no trouble with it. But not this time, when trying to install from virtual cd the installer says no cd; when booting to windows and using netinstall to...

kosztyua

Solved this second by doing:

/system scheduler
add disabled=no interval=0s name=fix-proxyarp on-event=":delay 15\r\
\n/interface virtual-ethernet set kvm-iface arp=proxy-arp" policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api start-time=startup

kosztyua

Found two bugs, sent them to support with supout, but posting here too. Just bought a new licence to make a vpn + userman server and found a bug. Not sure what caused it, but all the profiles created in userman are created with a customer account as owner, even when creating with the main parent acc...

kosztyua

A few minutes ago I found that a router started struggling (ping delay and drop). It has 5.22 x86, running as VPN concentrator and has a virtual machine on KVM. I managed to connect with winbox, and the log showed that the KVM has crashed and trying to restart - about 30 of this message and rising. ...

kosztyua

I thought this change with KVM meant that the "failed to copy files to image" bug is finally fixed. Seems it is not, still getting after upgrade.

kosztyua

Hey, I was halfway writing the network specs when I thought maybe all this does not interest you and will not add to give an opinion :D Let me redo it again! The server a CCR would exchange is an i7-2600 with 4Gb memo, in a datacenter with 1Gbit domestic and 100Mbit international ethernet. Currently...

kosztyua

Hi Dobby,

Thank you for your answer.
I was under the impression that CCR is already available, since my distributor is sending ads and accepting orders.
Yes, you are making a valid case with the testing and I guess I'll do that.

kosztyua

Hi, Currently we are using several X86 systems to operate a VPN service, offering PPTP, OVPN and SSTP connections, all operating on the mikrotik servers. We are considering trying the new cloud core router and have a few questions about it. Would you recommend this product for other than routing dut...

kosztyua

meh, im just going to consider it a bug, zero everything on this router, and upgrade to 6.0

kosztyua

bumping again, because i need to block smtp, and still cannot
what is wrong? any other port i tried was blocked fine, tcp/udp or even icmp can be filtered but for some reason smtp port 25 cannot :S:S:S

edit: ive set up a log and drop chain, with any port but 25 it is logged properly and dropped

kosztyua

No luck with any-port.
I did not have time to reboot or install new ros last night, thats still ahead..

kosztyua

Thank you for helping with such a nonsense situation.

Putting the filter to number 0 has no effect. With 80 the http is blocked, smtp passed.
Later this evening will reboot (production server..) and maybe setup an x86 to test with versions...

kosztyua

When running with port 80 there is matching (checking with browser to google.com), but there is none when using port 25 (checking with putty, telnet smtp.gmail.com:25)

kosztyua

Thank you for replying. There is no other filter that would effect port 25 for forwarding. This is the full export for filter: /ip firewall filter add action=drop chain=input comment=blacklist connection-state=new disabled=no src-address-list=blacklist add action=drop chain=forward comment=blacklist...

kosztyua

Hi, I have a very frustrating problem. I wanted to filter the traffic on port 25 coming from the vpn users. Since I failed in the more complex rule, I reduced it to a very basic one: /ip firewall filter add action=drop chain=forward disabled=no dst-port=25 protocol=tcp But still after using it I can...

kosztyua

Right after posting came the idea: what about running them of different ports and DNATing them via two ips and port 443?

kosztyua

Hi,

Would it be possible to run ovpn and sstp on port 443 on the same router via binding them to different ip addresses? On linux ofc this is managable, but routeros? We don't want to run a second router or kvm.

Thanks,
Andras

kosztyua

Hi, I was about to create a new kvm and I got this message when generating the image: failed to copy files to image. This was supposed to be my second kvm on a 5.19 x86 with 10240MB size. The first one with 4096MB worked fine. But now no other size works anymore, tried with 64MB, 128MB, 1024MB etc. ...

kosztyua

Thank you for the reply.

It seems the HDD burnt out and the RouterOS was running from memory, otherwise perfectly.

kosztyua

Hi, Today I could not log in to one of my routers with my own username, so after a few minutes I gave it a try and managed to log in with admin and no pass. What the hell? I recreated my login, logged out and after a few minutes tried to log in again, with no luck, it reverted back to admin again. N...

kosztyua

kosztyua

kosztyua

kosztyua

kosztyua

kosztyua

OK redid everything according to some sites' pptp settings, should be the same with openvpn... - OpenVPN client interface running on MT, connected - there is a masq nat for the interface and a preroute chain with mark - there is a route rule with openvpn interface and the mark Both with PPTP and Ope...

kosztyua

kosztyua

Hi, I am trying to connect to my vpn server, which is serving as vpn service like strongvpn. The server is working fine with windows clients (few problems, but essentially working), clients can connect, get the internal ip address, server does nat to give public ip, client gets new public ip, everyt...

kosztyua

Hi, I have the following problems using 5.13 x86 (5.14 had more openvpn bugs as i read and i dare not test 5.15 yet), using freeradius as authentication backend. - some connected users have the router's uptime in their connection uptime (even when actually they have just connected) - some users get ...

kosztyua

are the openvpn bugs introduced in 5.14 fixed? still using 5.13

kosztyua

Thank you for the reply! Yes, I am quite sure it is not due to the asymmetric line: for example my own internet connection is 120/10Mbit, and I am unable to reach more than 50/5. Compared to this, on linux based openvpn I was able to reach 20/8. So as I said, more download speed, less upload. Hope I...

kosztyua

Hi, I was wondering about the general view on mikrotik's openvpn solution. I understand that some people hate it because of the lack of udp and proper site-to-site. As for me, I need tcp (some proxy clients) in a manyclient-to-server setup. The initial tests (server on gigabit line, with 10 clients ...

kosztyua

bump?

kosztyua

Does RouterOS utilize multiple cpu cores when using it as OVPN server? If not for one session but for different clients? Curious, because on Linux it is not solved, running purely single-threaded and can use only 1 core.

kosztyua

UPDATE Just found something in the appendix which might mean what I dont have that EIRP limit. For ptp connections that use DSSS and/or OFDM and 5725 – 5875 MHz band I have a raised EIRP limit to if L ≥ 30 km, EIRPmax = 21 dBW if L < 30 km, EIRPmax = (6 + 0,5 L) dBW where L = distance Not sure about...

kosztyua

How do you like this setup for a mikrotik nstreme2 based backhaul? We have 30dBm EIRP limit and I want to get a high speed full duplex link. Jirous JRC-24 DuplEX 5GHz 24dBi x2 // for tx UBNT AirMax RocketDish 34dBi x2 // for rx UBNT SR71-15 x4 RouterBOARD 435G x2 Do you think with perfect conditions...

Search found 73 matches